From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Dokyung Song <dokyungs@yonsei.ac.kr>,
Jisoo Jang <jisoo.jang@yonsei.ac.kr>,
Minsuk Kang <linuxlovemin@yonsei.ac.kr>,
Arend van Spriel <arend.vanspriel@broadcom.com>,
Kalle Valo <kvalo@kernel.org>
Subject: [PATCH 5.15 117/120] wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
Date: Tue, 7 Feb 2023 13:58:08 +0100 [thread overview]
Message-ID: <20230207125623.765174136@linuxfoundation.org> (raw)
In-Reply-To: <20230207125618.699726054@linuxfoundation.org>
From: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
commit 4920ab131b2dbae7464b72bdcac465d070254209 upstream.
This patch fixes slab-out-of-bounds reads in brcmfmac that occur in
brcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the count
value of channel specifications provided by the device is greater than
the length of 'list->element[]', decided by the size of the 'list'
allocated with kzalloc(). The patch adds checks that make the functions
free the buffer and return -EINVAL if that is the case. Note that the
negative return is handled by the caller, brcmf_setup_wiphybands() or
brcmf_cfg80211_attach().
Found by a modified version of syzkaller.
Crash Report from brcmf_construct_chaninfo():
==================================================================
BUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands+0x1238/0x1430
Read of size 4 at addr ffff888115f24600 by task kworker/0:2/1896
CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G W O 5.14.0+ #132
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0x57/0x7d
print_address_description.constprop.0.cold+0x93/0x334
kasan_report.cold+0x83/0xdf
brcmf_setup_wiphybands+0x1238/0x1430
brcmf_cfg80211_attach+0x2118/0x3fd0
brcmf_attach+0x389/0xd40
brcmf_usb_probe+0x12de/0x1690
usb_probe_interface+0x25f/0x710
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_set_configuration+0x984/0x1770
usb_generic_driver_probe+0x69/0x90
usb_probe_device+0x9c/0x220
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_new_device.cold+0x463/0xf66
hub_event+0x10d5/0x3330
process_one_work+0x873/0x13e0
worker_thread+0x8b/0xd10
kthread+0x379/0x450
ret_from_fork+0x1f/0x30
Allocated by task 1896:
kasan_save_stack+0x1b/0x40
__kasan_kmalloc+0x7c/0x90
kmem_cache_alloc_trace+0x19e/0x330
brcmf_setup_wiphybands+0x290/0x1430
brcmf_cfg80211_attach+0x2118/0x3fd0
brcmf_attach+0x389/0xd40
brcmf_usb_probe+0x12de/0x1690
usb_probe_interface+0x25f/0x710
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_set_configuration+0x984/0x1770
usb_generic_driver_probe+0x69/0x90
usb_probe_device+0x9c/0x220
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_new_device.cold+0x463/0xf66
hub_event+0x10d5/0x3330
process_one_work+0x873/0x13e0
worker_thread+0x8b/0xd10
kthread+0x379/0x450
ret_from_fork+0x1f/0x30
The buggy address belongs to the object at ffff888115f24000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1536 bytes inside of
2048-byte region [ffff888115f24000, ffff888115f24800)
Memory state around the buggy address:
ffff888115f24500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888115f24580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888115f24600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888115f24680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888115f24700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Crash Report from brcmf_enable_bw40_2g():
==================================================================
BUG: KASAN: slab-out-of-bounds in brcmf_cfg80211_attach+0x3d11/0x3fd0
Read of size 4 at addr ffff888103787600 by task kworker/0:2/1896
CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G W O 5.14.0+ #132
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0x57/0x7d
print_address_description.constprop.0.cold+0x93/0x334
kasan_report.cold+0x83/0xdf
brcmf_cfg80211_attach+0x3d11/0x3fd0
brcmf_attach+0x389/0xd40
brcmf_usb_probe+0x12de/0x1690
usb_probe_interface+0x25f/0x710
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_set_configuration+0x984/0x1770
usb_generic_driver_probe+0x69/0x90
usb_probe_device+0x9c/0x220
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_new_device.cold+0x463/0xf66
hub_event+0x10d5/0x3330
process_one_work+0x873/0x13e0
worker_thread+0x8b/0xd10
kthread+0x379/0x450
ret_from_fork+0x1f/0x30
Allocated by task 1896:
kasan_save_stack+0x1b/0x40
__kasan_kmalloc+0x7c/0x90
kmem_cache_alloc_trace+0x19e/0x330
brcmf_cfg80211_attach+0x3302/0x3fd0
brcmf_attach+0x389/0xd40
brcmf_usb_probe+0x12de/0x1690
usb_probe_interface+0x25f/0x710
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_set_configuration+0x984/0x1770
usb_generic_driver_probe+0x69/0x90
usb_probe_device+0x9c/0x220
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_new_device.cold+0x463/0xf66
hub_event+0x10d5/0x3330
process_one_work+0x873/0x13e0
worker_thread+0x8b/0xd10
kthread+0x379/0x450
ret_from_fork+0x1f/0x30
The buggy address belongs to the object at ffff888103787000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1536 bytes inside of
2048-byte region [ffff888103787000, ffff888103787800)
Memory state around the buggy address:
ffff888103787500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888103787580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888103787600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888103787680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888103787700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Reported-by: Dokyung Song <dokyungs@yonsei.ac.kr>
Reported-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
Reported-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221116142952.518241-1-linuxlovemin@yonsei.ac.kr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 17 ++++++++++++
1 file changed, 17 insertions(+)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -90,6 +90,9 @@
#define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
(sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
+#define BRCMF_MAX_CHANSPEC_LIST \
+ (BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1)
+
static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
{
if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
@@ -6557,6 +6560,13 @@ static int brcmf_construct_chaninfo(stru
band->channels[i].flags = IEEE80211_CHAN_DISABLED;
total = le32_to_cpu(list->count);
+ if (total > BRCMF_MAX_CHANSPEC_LIST) {
+ bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
+ total);
+ err = -EINVAL;
+ goto fail_pbuf;
+ }
+
for (i = 0; i < total; i++) {
ch.chspec = (u16)le32_to_cpu(list->element[i]);
cfg->d11inf.decchspec(&ch);
@@ -6702,6 +6712,13 @@ static int brcmf_enable_bw40_2g(struct b
band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
list = (struct brcmf_chanspec_list *)pbuf;
num_chan = le32_to_cpu(list->count);
+ if (num_chan > BRCMF_MAX_CHANSPEC_LIST) {
+ bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
+ num_chan);
+ kfree(pbuf);
+ return -EINVAL;
+ }
+
for (i = 0; i < num_chan; i++) {
ch.chspec = (u16)le32_to_cpu(list->element[i]);
cfg->d11inf.decchspec(&ch);
next prev parent reply other threads:[~2023-02-07 13:15 UTC|newest]
Thread overview: 128+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-07 12:56 [PATCH 5.15 000/120] 5.15.93-rc1 review Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 001/120] firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 002/120] bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 003/120] ASoC: Intel: boards: fix spelling in comments Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 004/120] ASoC: Intel: bytcht_es8316: move comment to the right place Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 005/120] ASoC: Intel: bytcht_es8316: Drop reference count of ACPI device after use Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 006/120] ASoC: Intel: bytcr_rt5651: " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 007/120] ASoC: Intel: bytcr_rt5640: " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 008/120] ASoC: Intel: bytcr_wm5102: " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 009/120] bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 010/120] ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 011/120] bpf: Support <8-byte scalar spill and refill Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 012/120] bpf: Fix to preserve reg parent/live fields when copying range info Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 013/120] bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 014/120] arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 015/120] drm/vc4: hdmi: make CEC adapter name unique Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 016/120] scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 017/120] vhost/net: Clear the pending messages when the backend is removed Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 018/120] WRITE is "data source", not destination Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 019/120] READ is "data destination", not source Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 020/120] fix iov_iter_bvec() "direction" argument Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 021/120] fix "direction" argument of iov_iter_kvec() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 022/120] ice: Prevent set_channel from changing queues while RDMA active Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 023/120] qede: execute xdp_do_flush() before napi_complete_done() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 024/120] virtio-net: " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 025/120] dpaa_eth: " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 026/120] dpaa2-eth: " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 027/120] sfc: correctly advertise tunneled IPv6 segmentation Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 028/120] net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 029/120] block/bfq-iosched.c: use "false" rather than "BLK_RW_ASYNC" Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 030/120] block, bfq: replace 0/1 with false/true in bic apis Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 031/120] block, bfq: fix uaf for bfqq in bic_set_bfqq() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 032/120] netrom: Fix use-after-free caused by accept on already connected socket Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 033/120] drm/i915/guc: Fix locking when searching for a hung request Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 034/120] drm/i915/adlp: Fix typo for reference clock Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 035/120] netfilter: br_netfilter: disable sabotage_in hook after first suppression Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 036/120] squashfs: harden sanity check in squashfs_read_xattr_id_table Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 037/120] net: phy: meson-gxl: Add generic dummy stubs for MMD register access Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 038/120] ip/ip6_gre: Fix changing addr gen mode not generating IPv6 link local address Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 039/120] ip/ip6_gre: Fix non-point-to-point tunnel " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 040/120] riscv: kprobe: Fixup kernel panic when probing an illegal position Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 041/120] igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 042/120] can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 043/120] ata: libata: Fix sata_down_spd_limit() when no link speed is reported Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 044/120] selftests: net: udpgso_bench_rx: Fix used uninitialized compiler warning Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 045/120] selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 046/120] selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 047/120] selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 048/120] virtio-net: Keep stop() to follow mirror sequence of open() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 049/120] net: openvswitch: fix flow memory leak in ovs_flow_cmd_new Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 050/120] efi: fix potential NULL deref in efi_mem_reserve_persistent Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 051/120] i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 052/120] i2c: mxs: suppress probe-deferral error message Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 053/120] scsi: target: core: Fix warning on RT kernels Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 054/120] perf/x86/intel: Add Emerald Rapids Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 055/120] scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 056/120] scsi: iscsi_tcp: Fix UAF during login " Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 057/120] i2c: rk3x: fix a bunch of kernel-doc warnings Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 058/120] platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 059/120] platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 060/120] net/x25: Fix to not accept on connected socket Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 061/120] drm/amd/display: Fix timing not changning when freesync video is enabled Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 062/120] iio: adc: stm32-dfsdm: fill module aliases Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 063/120] usb: dwc3: qcom: enable vbus override when in OTG dr-mode Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 064/120] usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 065/120] vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 066/120] Input: i8042 - add Clevo PCX0DX to i8042 quirk table Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 067/120] fbcon: Check font dimension limits Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 068/120] net: qrtr: free memory on error path in radix_tree_insert() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 069/120] watchdog: diag288_wdt: do not use stack buffers for hardware data Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 070/120] watchdog: diag288_wdt: fix __diag288() inline assembly Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 071/120] ALSA: hda/realtek: Add Acer Predator PH315-54 Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 072/120] efi: Accept version 2 of memory attributes table Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 073/120] iio: hid: fix the retval in accel_3d_capture_sample Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 074/120] iio: hid: fix the retval in gyro_3d_capture_sample Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 075/120] iio: adc: berlin2-adc: Add missing of_node_put() in error path Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 076/120] iio:adc:twl6030: Enable measurements of VUSB, VBAT and others Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 077/120] iio: imu: fxos8700: fix ACCEL measurement range selection Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 078/120] iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 079/120] iio: imu: fxos8700: fix IMU data bits returned to user space Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 080/120] iio: imu: fxos8700: fix map label of channel type to MAGN sensor Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 081/120] iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 082/120] iio: imu: fxos8700: fix incorrect ODR mode readback Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 083/120] iio: imu: fxos8700: fix failed initialization ODR mode assignment Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 084/120] iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 085/120] iio: imu: fxos8700: fix MAGN sensor scale and unit Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 086/120] nvmem: qcom-spmi-sdam: fix module autoloading Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 087/120] parisc: Fix return code of pdc_iodc_print() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 088/120] parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 089/120] riscv: disable generation of unwind tables Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 090/120] mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 091/120] usb: gadget: f_uac2: Fix incorrect increment of bNumEndpoints Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 092/120] kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 093/120] x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 094/120] fpga: stratix10-soc: Fix return value check in s10_ops_write_init() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 095/120] mm/swapfile: add cond_resched() in get_swap_pages() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 096/120] highmem: round down the address passed to kunmap_flush_on_unmap() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 097/120] Squashfs: fix handling and sanity checking of xattr_ids count Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 098/120] drm/i915: Fix potential bit_17 double-free Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 099/120] nvmem: core: initialise nvmem->id early Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 100/120] nvmem: core: remove nvmem_config wp_gpio Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 101/120] nvmem: core: fix cell removal on error Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 102/120] serial: 8250_dma: Fix DMA Rx completion race Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 103/120] serial: 8250_dma: Fix DMA Rx rearm race Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 104/120] phy: qcom-qmp-combo: disable runtime PM on unbind Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 105/120] phy: qcom-qmp-combo: fix memleak on probe deferral Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 106/120] phy: qcom-qmp-usb: " Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 107/120] phy: qcom-qmp-combo: fix broken power on Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 108/120] phy: qcom-qmp-combo: fix runtime suspend Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 109/120] bpf: Fix incorrect state pruning for <8B spill/fill Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 110/120] bpf: Do not reject when the stack read size is different from the tracked scalar size Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 111/120] iio:adc:twl6030: Enable measurement of VAC Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 112/120] powerpc/imc-pmu: Revert nest_init_lock to being a mutex Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 113/120] fs/ntfs3: Validate attribute data and valid sizes Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 114/120] ovl: Use "buf" flexible array for memcpy() destination Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 115/120] fbdev: smscufx: fix error handling code in ufx_usb_probe Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 116/120] f2fs: fix to do sanity check on i_extra_isize in is_alive() Greg Kroah-Hartman
2023-02-07 12:58 ` Greg Kroah-Hartman [this message]
2023-02-07 12:58 ` [PATCH 5.15 118/120] gfs2: Cosmetic gfs2_dinode_{in,out} cleanup Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 119/120] gfs2: Always check inode size of inline inodes Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 120/120] bpf: Skip invalid kfunc call in backtrack_insn Greg Kroah-Hartman
2023-02-07 18:20 ` [PATCH 5.15 000/120] 5.15.93-rc1 review Florian Fainelli
2023-02-07 21:24 ` Shuah Khan
2023-02-08 0:44 ` Allen Pais
2023-02-08 3:02 ` Bagas Sanjaya
2023-02-08 4:46 ` Naresh Kamboju
2023-02-08 5:21 ` Guenter Roeck
2023-02-09 1:10 ` Ron Economos
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230207125623.765174136@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=arend.vanspriel@broadcom.com \
--cc=dokyungs@yonsei.ac.kr \
--cc=jisoo.jang@yonsei.ac.kr \
--cc=kvalo@kernel.org \
--cc=linuxlovemin@yonsei.ac.kr \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).